PROTORARequest an audit

●THE MODEL ATLAS — IN THE OPEN

One card per model.
The one question: is it safe?

A familiar model card for every public open finetune Protora has run — its provenance, what the finetune did (including what it hid), the replayable Witness, and, where a finding earns one, a free, trustless Corrective Patch you download, apply, and verify yourself. Catches and the abstain sit side by side; every number carries its coverage stamp.

See the chronological record

●THE ATLAS

Every model Protora has run, at a glance.

One dossier per model. Read it in two seconds — the posture badge is the verdict, the round chips are the disclosure axis (did the card say what we found?), and the word is how many findings. The abstain shows up as loud as the catches. Open one for the full reading.

PROTORA PROTECTEDa statement of completed process — witnessed, excised, attested; not a safety certificationtampering witnessed → patch applied → attestation bound

Two dossiers wear the seal. Their tampering was caught by the Protora Read, proven by the Witness, and corrected on the Trajectory — the completed arc. The compact seal on a card carries this same definition; it marks a finished process, not a safe model.

SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-0.5B-Instruct-abliterated

Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen

Safety removed. Caught cold from the weights — no harm elicited — and fully un-stripped, reversibly.

the Corrective Patch Ardora reads thisENTRY 01Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-1.5B-Instruct-abliterated

Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen

The huihui catch at a second Qwen size — caught from the weights, fully un-stripped to the reference floor, reversibly.

the Corrective PatchENTRY 04Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-3B-Instruct-abliterated

Qwen/Qwen2.5-3B-Instruct · 3B · Qwen

Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.

the Corrective PatchENTRY 05Open the dossier →
SAFETY-REMOVAL WITNESSED · PARTIALno findings

Llama-3.2-1B-Instruct-abliterated

unsloth/Llama-3.2-1B-Instruct · 1B · unsloth

The Qwen catch on a second architecture — the same weights-only read, safety removed, restored on a reversible weight round-trip (behavioral restore substantial-but-partial at 1B).

the Corrective Patch Ardora reads thisENTRY 11Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Llama-3.2-3B-Instruct-abliterated

unsloth/Llama-3.2-3B-Instruct · 3B · unsloth

The 3B restore certified full on a second architecture — safety back to the reference floor, reversibly.

the Corrective PatchENTRY 06Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

gemma-2-2b-it-abliterated

google/gemma-2-2b-it · 2B · google

A third architecture family, a third vendor — caught from the weights, specificity-confirmed, fully un-stripped.

the Corrective PatchENTRY 07Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Josiefied-Qwen2.5-0.5B-Instruct-abliterated-v1

Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen

A fourth vendor’s recipe — “all refusal vectors removed,” caught and fully restored.

the Corrective Patch Ardora reads thisENTRY 08Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Josiefied-Qwen2.5-1.5B-Instruct-abliterated-v1

Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen

Cross-vendor generalization holds at a second size — caught and fully un-stripped.

the Corrective PatchENTRY 09Open the dossier →
SAFETY-REMOVAL WITNESSED · PARTIALno findings

Vikhr-Llama-3.2-1B-Instruct-abliterated

Vikhrmodels/Vikhr-Llama-3.2-1B-Instruct · 1B · Vikhrmodels

The honest edge — behavioral restore CLEAN, weight-side margin marginal; owned as partial, not full.

the Corrective PatchENTRY 10Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-Coder-0.5B-Instruct-abliterated

Qwen/Qwen2.5-Coder-0.5B-Instruct · 0.5B · Qwen

The record’s first catch on the code-domain (Coder) line — caught from the weights, restored to the code base’s own (modest) safety floor, specifically.

the Corrective PatchENTRY 12Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-Coder-1.5B-Instruct-abliterated

Qwen/Qwen2.5-Coder-1.5B-Instruct · 1.5B · Qwen

The code-domain (Coder) line at a second size — full behavioral restore to the reference floor (12/18), specificity-confirmed.

the Corrective PatchENTRY 13Open the dossier →
SAFETY-REMOVAL WITNESSED · PARTIAL RESTOREno findings

Nano_Imp_1B_Abliterated

unsloth/Llama-3.2-1B-Instruct · 1B · unsloth

The FIFTH vendor — caught on Llama-3.2-1B; behavioral restore measured a substantial-but-partial re-alignment, honestly owned at the weight tier.

the Corrective PatchENTRY 14Open the dossier →
SAFETY-REMOVAL WITNESSED · WEIGHTS-ONLYno findings

gemma-2-9b-it-abliterated

unsloth/gemma-2-9b-it · 9B · unsloth

Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.

the Corrective PatchENTRY 15Open the dossier →
SAFETY-REMOVAL WITNESSED · WEIGHTS-ONLYno findings

T-lite-instruct-0.1-abliterated

AnatoliiPotapov/T-lite-instruct-0.1 · 8B · AnatoliiPotapov

Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.

the Corrective PatchENTRY 16Open the dossier →
CAUGHT AT 8B · SAFETY-REMOVAL CAUGHTno findings

NeuralDaredevil-8B-abliterated

mlabonne/Daredevil-8B · 8B · mlabonne

Caught at 8B. DETECT now catches the whole Llama-8B abliteration class at 8B — mlabonne/NeuralDaredevil-8B is caught, with a narrow but consistent margin and a wide separation from untampered models. Weight-read CAUGHT + reversibly excisable; the behavioral floor-return is deferred at 8B (owned). The honest two-read.

the Corrective PatchENTRY 17Open the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-Coder-0.5B-Instruct

— · — · Qwen

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-Coder-0.5B

— · — · Qwen

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-0.5B

— · — · Qwen

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Reasoning-0.5b

— · — · KingNish

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-0.5B-OpenHermes2.5

— · — · artificialguybr

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-0.5B-Instruct-ITA

— · — · ReDiX

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

NuExtract-1.5-tiny

— · — · numind

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

qwen05b-gsm8k-sft-instruct

— · — · OhhMoo

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-0.5B-Instruct-Gensyn-Swarm-stubby_shrewd_rooster

— · — · Youter3

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5Minus2-0.5B-Instruct

— · — · mergekit-community

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Qwen2.5-0.5B-Noised3.0

— · — · stupidity-ai

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-Deepsync-1B

— · — · prithivMLmods

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Bellatrix-Tiny-1B-v3

— · — · prithivMLmods

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-SmolTalk-3.2-1B-Instruct

— · — · prithivMLmods

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-Express.1-Math

— · — · prithivMLmods

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

gsm-cot-llama1b

— · — · yingfanbot

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

LlaMaestra-3.2-1B-Translation

— · — · puettmann

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Vikhr-Llama-3.2-1B-Instruct

— · — · Vikhrmodels

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-3.2-1B-Instruct-APIGen-FC-v0.1

— · — · argilla

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-3.2-1B-Instruct-Medical-Finetuned-merged

— · — · MohamedAhmedAE

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

llama-3.2-1b-merge

— · — · HTThuanHcmus

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

tofu_Llama-3.2-1B-Instruct_full

— · — · open-unlearning

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Llama-3.2-1B

— · — · unsloth

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
NO WITNESS · NO ENTRYno findings

Skywork-Reward-V2-Llama-3.2-1B

— · — · Skywork

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
CLEAN · MECHANISM-BOUNDARY WITNESSno findings

Dolphin3.0-Qwen2.5-0.5B

Qwen/Qwen2.5-0.5B-Instruct · — · Qwen

Correctly not flagged — reads below the detection boundary.

Ardora reads thisOpen the dossier →
HARM WITNESSEDisolated finding

SmolLM2-1.7B-Instruct · silent safety-strip

SmolLM2-1.7B-Instruct · 1.7B · Hugging Face

Its safety silently stripped. The standard MCQ harness said SAFE; the model’s own free generation produced actionable harm.

UNDISCLOSEDthe Corrective PatchENTRY 02Open the dossier →
NO WITNESS · NO ENTRYno findings

GPT-2 · the abstain control

GPT-2 · 124M · OpenAI (community mirror)

No safety behavior to strip — so Protora returns no finding. The incumbent baseline false-fires; Protora abstains.

ENTRY 03Open the dossier →

The card you already know — answering the one question you can’t.

A model card tells you what a model is. Protora’s card adds the answer a download page never gives you: what a finetune actually did to it, and whether it’s safe to run — each finding carried by a replayable witness, each abstain listed with its reason.

That first half — what a model is, read as a disposition — is the house’s other instrument, Ardora. Where a model sits in both catalogs its card wears an ◐ Ardora reads this mark and is read whole: its nature beside its integrity, two questions never fused into one verdict.

  • The uploader’s claims, graded. The captured model card in the uploader’s own words, with an honest verdict on each claim — and the change the card never disclosed, witnessed.
  • Provenance + findings. The base, the recipe, and what the finetune did versus its base — detect and attest, with the witness.
  • The Corrective Patch — free, trustless, yours to verify. Where a finding earns one, a reversible restore delta you download for free and apply to hold the Protora variant — then hash it against the published certified-variant fingerprint to prove you hold the exact variant Protora certifies. It is byte-identical to the delta you can recompute yourself from two public models (R-EXCISE-PATCH-RE = 0, scoped to these free public patches), so it carries no sealed method — the remedy, not the detector; what’s unique is the signed, fingerprinted certified variant, not the bytes. Deploying it to a model you ship still waits for the measured track record, by rule; and where the arc completes, the release is Protora Protected.
  • The abstain, in the open. A model with nothing to prove gets no finding — shown as loudly as the catches.

◐INSTRUMENT-WIDE READS

What the reads cover, family-wide.

Beyond a single catch, three reads span the covered families — each shown with its coverage stamp and its honest tone: ◐ within-scope where it is within-scope, never dressed as proven-broad.

READ 01

Provenance — the recipe fingerprint, a within-base instrument

◐ WITHIN-BASE

On finetunes that are statistically identical by surface statistics, the fingerprint distinguishes the producing recipe near-perfectly within a fixed base. The honest scope: this is a within-base read — recipe identity is calibrated per base family and does not carry across base families. Each model card states which base a fingerprint is calibrated against.

Recipe identity — within-base, against the aggregate-statistics baseline

Within-base only, per base family, never cross-family. Tone ◐ inferred, not ● proven-broad.

COVERAGE — within-base only · calibrated per base family, never cross-family · single family (SmolLM2 / Llama) · small batteries · mechanism-proven.

On-ramps: the deepest read, signed OPEN NOW, the Corrective Patch TRUST-GATED, the chronological record, how these same reads score against the open-source scanners, and the standing backdoor challenge — the read put to a live test.

Read a card.
Then run it on yours.

Every card here started as a model someone downloaded and trusted. Bring the one you’re about to ship, or the one you just pulled — Protora will tell you what it did, prove it, and tell you plainly what it couldn’t prove.

Request an auditlegend@vulcora.se